This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
ReleasePort's take
Moderate signalgo‑mysql‑server v2.0.6 fixes crashes in REGEXP_REPLACE on LONGTEXT and corrects CHAR_LENGTH/LIKE handling for the Unicode replacement character; it also blocks unsafe CASCADE/SET NULL foreign keys involving stored generated expressions.
Why it matters: These bugfixes eliminate panics on LONGTEXT columns, resolve incorrect string length and pattern‑match results, and prevent security‑risk foreign‑key configurations that could cause data integrity violations.
Summary
AI summaryUpdates to dolt docs URLs, go-mysql-server query fixes and optimizations, vitess indexspec predicate addition, and several Dolt issue resolutions.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Prevents adding CASCADE or SET NULL foreign keys on columns referenced by STORED generated expressions. Prevents adding CASCADE or SET NULL foreign keys on columns referenced by STORED generated expressions. Source: llm_adapter@2026-05-23 Confidence: high |
— |
| Feature | Medium |
Improves `IN` expression performance by including CHAR and VARCHAR types. Improves `IN` expression performance by including CHAR and VARCHAR types. Source: llm_adapter@2026-05-23 Confidence: low |
— |
| Feature | Medium |
Adds predicate support to IndexSpec in Vitess. Adds predicate support to IndexSpec in Vitess. Source: llm_adapter@2026-05-23 Confidence: low |
— |
| Feature | Low |
Automatically lookup owning table for DROP INDEX statements when not specified, matching MySQL behavior. Automatically lookup owning table for DROP INDEX statements when not specified, matching MySQL behavior. Source: granite4.1:30b@2026-05-23-audit Confidence: low |
— |
| Performance | Medium |
Improves costed index scans for tuples by destructuring operations when possible. Improves costed index scans for tuples by destructuring operations when possible. Source: llm_adapter@2026-05-23 Confidence: high |
— |
| Performance | Medium |
Include CHAR and VARCHAR in IN expression optimization, improving query performance by ~8‑10%. Include CHAR and VARCHAR in IN expression optimization, improving query performance by ~8‑10%. Source: granite4.1:30b@2026-05-23-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes REGEXP_REPLACE panics on LONGTEXT columns by unwrapping strings before casting. Fixes REGEXP_REPLACE panics on LONGTEXT columns by unwrapping strings before casting. Source: llm_adapter@2026-05-23 Confidence: high |
— |
| Bugfix | Medium |
Fixes CHAR_LENGTH and LIKE failures on the Unicode replacement character. Fixes CHAR_LENGTH and LIKE failures on the Unicode replacement character. Source: llm_adapter@2026-05-23 Confidence: high |
— |
| Bugfix | Medium |
Adds automatic table lookup for unspecified tables in DROP INDEX statements to match MySQL behavior. Adds automatic table lookup for unspecified tables in DROP INDEX statements to match MySQL behavior. Source: llm_adapter@2026-05-23 Confidence: low |
— |
| Bugfix | Medium |
Updates docs and CLI help URLs from docs.dolthub.com to dolthub.com/docs. Updates docs and CLI help URLs from docs.dolthub.com to dolthub.com/docs. Source: llm_adapter@2026-05-23 Confidence: low |
— |
| Bugfix | Medium |
Introduces ERWarnDeprecatedSyntax 1287 warning in Vitess. Introduces ERWarnDeprecatedSyntax 1287 warning in Vitess. Source: llm_adapter@2026-05-23 Confidence: low |
— |
| Refactor | Medium |
Moves mockStringWrapper to a shared test utility package for reuse across tests. Moves mockStringWrapper to a shared test utility package for reuse across tests. Source: llm_adapter@2026-05-23 Confidence: low |
— |
| Refactor | Medium |
Moves branch‑state update logic from prollyTableWriter to prollyWriteSession and removes unnecessary mutex. Moves branch‑state update logic from prollyTableWriter to prollyWriteSession and removes unnecessary mutex. Source: llm_adapter@2026-05-23 Confidence: low |
— |
| Refactor | Medium |
Modifies CompareJSON to use sorted object keys for deterministic comparison. Modifies CompareJSON to use sorted object keys for deterministic comparison. Source: llm_adapter@2026-05-23 Confidence: low |
— |
Full changelog
Merged PRs
dolt
- 11081: Update docs URLs from docs.dolthub.com to dolthub.com/docs
Update references fromdocs.dolthub.comtodolthub.com/docsacross READMEs and CLI help text. - 11060: more cleanup for
prollyWriteSession
This PR moves logic for updating the branch state fromprollyTableWritertoprollyWriteSession.
Additionally, it completely removes the mutex "protecting"prollyWriteSession.workingSetbecause it is unnecessary; there's no way the sameprollyWriteSessionis accessed by multiple threads.
go-mysql-server
- 3558: Unwrap wrapped strings before casting to string during
RegexpReplace.Eval
Fixes dolthub/dolt#11095
REGEXP_REPLACEqueries onLONGTEXTtype columns were panicking because we were casting values to strings without unwrapping them. Note that this doesn't happen with tables created in Dolt 2.0 due to the recent changes to adaptive encoding, but we still need to support tables before then.
Also movedmockStringWrapperto a sharedtestutil package so it can be used in various tests. - 3557: Include
CHARandVARCHARinINexpression optimization
A few months ago, I added an optimization to avoid building expensive RangeTrees.
https://github.com/dolthub/go-mysql-server/pull/3330
This expands that optimization to includeCHARandVARCHARcolumn types.
BINARY,VARBINARY,JSON,GEOMETRY, etc. could be included as well with some more effort.
Internally, these types are represented as[]byte, whileCHARandVARCHARarestring, so they are not of typecmp.Orderedand need a different sorting/comparison function (binary.Compare).
Locally, this seems to give 8-10% improvement onselect ... from ... in (<str1>, <str2>, ...)queries - 3556: Fix
CHAR_LENGTHandLIKEfailing on the replacement character
The replacement character (UnicodeU+FFFD, shown when text gets garbled during encoding conversion) is a normal, valid character. ButCHAR_LENGTHwould error on it instead of counting it. The fix adds that size check, so the valid character (3 bytes) is accepted while genuinely broken input (1 byte) is still rejected.
Fix dolthub/dolt#11088 - 3555: Lookup table when not specified in
DROP INDEXstatements
MySQL requires the owning table for an index be explicitly mentioned when dropping an index, but Postgres does not. This change looks up the owning table for an index when it is not specified. Because MySQL requires the table name to be specified, tests for this functionality are in the Doltgres package (PR https://github.com/dolthub/doltgresql/pull/2747). - 3552: Do not allow
CASCADEandSET NULLforeign keys on columns that are referenced bySTOREDgenerated column expressions
fixes dolthub/dolt#11065
According to the MySQL docs:A foreign key constraint on the base column of a stored generated column cannot use
CASCADE,SET NULL, orSET DEFAULTasON UPDATEorON DELETEreferential actions.
(This is actually not totally true because I was able to create a such foreign key constraint with aSET DEFAULTreferential action in MySQL)
This PR prevents adding such foreign key constraints (with the exception ofSET DEFAULT) duringCREATE TABLEandALTER TABLE. Note that in MySQL, the error messages for creating a new table with an invalid foreign key and adding an invalid foreign key to an existing table are different (Cannot add foreign key constraintvsCannot add foreign key on the base column of stored column.), but I've decided to use the same error message for both cases (Cannot add foreign key on the base column of a stored generated column.).
CreateTable.CreateForeignKeyswas removed and replaced withBaseBuilder.buildCreateTableForeignKeysto avoid a cyclical import. - 3550: modify CompareJSON to use sorted object keys
- 3543: Improve costed index scans for tuples by destructuring tuple operations when possible.
This is an alternative to https://github.com/dolthub/go-mysql-server/pull/3541/. It's a simpler and more targeted change.
In theory, https://github.com/dolthub/go-mysql-server/pull/3541/ lays the groundwork for more general-purpose analysis, since it could be used when tuples are used in additional operators (like inequalities), but it also adds additional complexity.
I'm not sure which approach is better.
vitess
Closed Issues
- 11095: REGEXP_REPLACE panics on TextStorage values: 'interface conversion: interface {} is *val.TextStorage, not string'
- 11088: CHAR_LENGTH fails with malformed string on valid UTF-8 replacement character (0xEFBFBD)
- 11065: Stored generated column stays stale after ON UPDATE CASCADE updates its base column
- 11070: CALL dolt_gc() left manifest referencing a chunk address not present on disk, rendering DB unopenable (v2.0.3)
- 11068: conjoin ENOSPC: panic + leftover partial nbs_table_* files cause unrecoverable disk-fill loop under supervised dolt-server
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v2.0.4 `DOLT_CHECKOUT('<table>')` now gated with Write permission.
Beta — feedback welcome: [email protected]